Security Researchers Uncover Global Spyware Campaign Exploiting Legitimate Advertising Networks

The researchers at Citizen Lab provided a scathing assessment of Discover-Tech’s business model, suggesting that the company’s public-facing image as a legitimate advertising business was merely a facade. "Discover-Tech presents itself as a legitimate online advertising business," the researchers stated. "In fact, the Israel-based company provides a bridge between multiple mercenary spyware companies engaged in hacking and the legitimate online advertising ecosystem."

The investigation found no evidence that Discover-Tech was engaged in any genuine commercial advertising activities. Instead, the researchers discovered billions of instances where the company bid on advertising slots with the sole intention of sending malicious content to users. The Controlium platform served as the technical engine for this "bridge," allowing mercenary spyware firms to piggyback on the legitimate bidding process that governs which ads appear on a user’s screen.

The technical process behind these infections is both elegant and terrifying in its simplicity. When a user opens an app or a website, an automated auction takes place in milliseconds to decide which ad to show. Discover-Tech participated in these auctions, using the opportunity to mass-profile and de-anonymize millions of users. Once a specific target was identified through this profiling, the platform would win the bid to serve them an ad. This seemingly harmless advertisement would contain malicious JavaScript code. As soon as the browser or the app executed this code to render the ad, the exploit would trigger, bypassing the device’s security layers to install the spyware payload.

The clients of the Controlium platform include some of the most notorious names in the mercenary surveillance world. Among them is Candiru, an Israeli-linked spyware company that has reportedly been acquired by the U.S.-based Integrity Labs. Candiru has previously been sanctioned by the U.S. Commerce Department for developing and selling spyware used to target a wide range of individuals, including government officials, activists, academics, and embassy workers. The Controlium platform was also linked to Bindecy, an Israeli firm specializing in zero-click mobile exploits, and another surveillance firm known as Intelos.

The revelation of Discover-Tech’s activities has cast a harsh light on the lack of oversight within the digital advertising industry. Despite its role in facilitating high-level hacking and mass profiling, Discover-Tech had managed to secure a place on several "certified" and "approved" advertising vendor lists. These lists are maintained by industry giants and trade associations, including Google and IAB Europe, the leading European-level industry association for the digital advertising and marketing ecosystem.